Technical Field
This disclosure relates generally to web application security and in particular to on-boarding applications used in association with a Web portal.
Background of the Related Art
It is known in the prior to provide so-called Web portals, which are web-based reverse proxy mechanisms that centralize access to information, applications, and services for employees, customers, or partners. A Web portal delivers a consolidated view that lets users access electronic resources of the organization using a standard technology (e.g., a web browser), simply and efficiently. Within a Web portal or like environment, typically a proxy or web server acts as a front-end “point of contact” to a set of back-end applications or application components. In this type of environment, it is desirable that the mechanism used to provide authentication and session management at the web portal layer should also provide these functions for any back-end applications that are included in a consolidated view.
Companies want to make web-based business applications available to internal and external users. Indeed, a company may have thousands of applications, using a wide variety of technologies, which may have been developed in-house or may be third party applications. Further, the number and variety of applications that a company supports may well grow over time. Each of these applications must be secured, such that only authorized users are permitted access. To secure the applications, user authentication is required along with coarse-grained or fine-grained authorization over the function provided by the applications. As described above, to centralize the authentication and authorization, many companies use Web portals (i.e., web reverse proxy products) as gateways to their applications. As described above, when the web reverse proxy is used, it sits in front of the application and handles the authentication and authorization functions, and it passes the information to the application.
Because each application may be implemented using different technologies, it may require a significant amount of effort to integrate (also referred to as “boarding” or “on-boarding”) an application with the web reverse proxy. Indeed, the problem of boarding an application to a Web portal can be quite challenging. Current techniques to integrate the applications require both security professionals and business application owners to manually gather and discover the characteristics of each of the applications so that Web proxy experts can successfully integrate the application. This requirement can prove to be difficult, at least in part because security professionals and application owners have different levels of knowledge and use different vocabularies. It can also take a large amount of time to determine the proper information for each application, thus making the time to board thousands of applications prohibitive.